CVE-2026-89271

Name of the Vulnerable Software and Affected Versions WP-BusinessDirectory versions prior to 4.0.3

Description An unauthenticated upload handler in the WP-BusinessDirectory WordPress plugin fails to restrict the type or destination of saved files. This allows unauthenticated attackers to write files containing arbitrary content to arbitrary locations on the server, although code execution is not possible under a default server configuration. The issue is associated with the uploadFile function.

Recommendations Update WP-BusinessDirectory to version 4.0.3 or later.